Rebar3 versions 3.0.0-beta.3 up to and including 3.13.2 suffer from a command injection vulnerability.